A small hub of active, external hostile disinformation actors has been identified and is working in conjunction with a domestic disinformation operation to advance Yellow Vest and WTO narratives.
The network has been accessing the UKIP audience in order to drive narratives into a broader range of visibility.
The threat comprises human-managed (troll) and cyborg (part automated, human-managed accounts).
This is an active, medium risk threat, designated ‘Osprey’.
During the course of routine analysis, the hashtag #LetsGotWTO was identified as growing in popularity and visibility. This was placed on automatic monitor.
Random manual sampling of alerts identified a number of accounts engaged with the hashtag were displaying characteristics including signs of automated behaviour, message cut and pasting, and targeted re-tweeting of content provided by The Bruges Group.
During the Brexit campaign, The Bruges Group received £60,000 from UKIP donor Patrick Barbour and, in turn, donated £12,000 to Peter Bone’s Grass Roots Out campaign and £5,000 to Vote Leave, the official campaign.
The network of accounts identified was pushing a tweet of the Bruges Group sent on January 26. The post contained an embedded video of their own making featuring Sir Bill Cash and, at the time of analysis, attained 2.4k likes and 2.4k retweets and had been viewed 34,500 times.
The accounts monitored, 87 in total, were examined in detail using a three stage analytical process which accounts for failure rates in software designed to identify bots and trolls, followed by an intelligence assessment.
Of the 87 Accounts identified, 17 have been classified as hostile human-managed, and a further 32 have been classified as bots (with high confidence they are cyborg accounts, partially automated but human-managed, rather than AI).
In total, 56.32% of the accounts have been identified as bots/trolls.
At stage 1 of the assessment 45 accounts were identified as bots, at stage 2, 55, and at stage 3, 39. On average, across the three stages of system-led review, 53.26% of the accounts were identified as bots/trolls.
The accounts were first tested using the University Of Indiana ‘Botometer‘ service, the failure rate for which was calculated during the Scotland research. The threshold at which accounts can be most successfully identified using this service is where their overall score is greater than 0.1.
Botometer identified 45 of the 87 accounts as being suspected bots/trolls.
At the second stage, the accounts were tested using Mike Hawks ‘Tweet Bot Or Not‘ service via Shiny Apps, which uses machine learning to identify the probability of an account being a bot or troll. Again, the failure rate was calculated during the Scotland research. The threshold at which accounts can be most successfully identified using this service is where the probability score is over 0.6.
Bot or Not identified 55 of the 87 accounts as being suspected bots/trolls.
At the final stage, the accounts were tested using ‘Bot Sentinel‘, a web service which gives a percentage likelihood of accounts being bots/trolls. The failure rate for this service is known, subsequently any score above 25% is within the most successful identification threshold.
Bot Sentinel identified 39 of the accounts as being suspected bots/trolls.
The two groups featuring high risk elements were taken forward for further analysis.
The high risk group has been placed on a live monitoring regime, in order to maintain tracking capability on disinformation campaigns in real time.
A detailed view of the whole cluster of 87 accounts shows that, over the last seven days, the cluster has created 37,330 tweets, achieving 46,535 likes and retweets and an average engagement rate of 2.76%. The total audience for the cluster is 124,588 followers.
Over the seven day period, analysis of the most popular posts across the cluster shows a broadly balanced and organic conversation which could be found in most Brexit leave network analysis, with the exception of the Bruges Group and LetsGoWTO mentions which are being artificially amplified by the sub-networks.
The moderate to high risk network of 32 accounts makes up 37% of the cluster. Over the same period this sub-network created 16,029 tweets, achieving 16,836 likes and retweets and an average engagement rate of 10.78%. The total audience for the moderate to high risk network is 43,798 followers.
The moderate to high risk network of 32 accounts generates 42.94% of all tweets in the cluster, achieving 36.18% of likes and retweets. This network is responsible for 35.15% of the audience for the cluster and achieves engagement 8.02% higher than across the cluster as a whole.
Over the seven days, analysis of the top posts within the moderate to high risk network shows a grater prominence of UKIP specific conversation. The network’s core purpose is message amplification of Bruges Group content in line with UKIP communications.
The high risk network of 14 accounts makes up 16% of the cluster. Over the same period this sub-network created 6,710 tweets, achieving 981 likes and retweets and an average engagement rate of 8.75%. The total audience for the moderate to high risk network is 16,805 followers.
The high risk network of 14 accounts generates 17.97% of all tweets in the cluster, achieving 2.11% of likes and retweets. This network is responsible for 13.49% of the audience for the cluster and achieves engagement 5.99% higher than across the cluster as a whole.
Over time, the network’s hashtag use largely confirms their purpose, solidly illustrating a shift between all core tasked troll farm operations from Trump, to Brexit, to the Yellow Vests and beyond.
The OSPREY network is medium risk overall and this will be reviewed regularly.
You can find resources for performing your own bot and troll checks, and monitoring UK disinformation, at Brit Or Bot.